Security readout for executives and security teams
Plain-English summary
An authenticated OPNsense user with PPP edit rights could store malicious HTML/script content through a point-to-point interface identifier. That content may run when another user opens the interface assignment page. This is a medium-risk admin-console issue: impact depends on who has delegated PPP permissions and who later views the affected page.
Executive priority
Treat this as a scheduled but real remediation item. Prioritize faster where OPNsense administration is delegated to multiple teams, contractors, or managed service accounts, because compromise may affect administrator browser sessions and console trust.
Technical view
CVE-2025-34182 is stored XSS in Deciso OPNsense before 25.7.4. The ptpid parameter in /interfaces_ppps_edit.php was not sanitized for HTML-related characters and was rendered in /interfaces_assign.php. Vendor notes describe the fix as correcting legacy_html_escape_form_data() so keys, not only data elements, are escaped.
Likely exposure
Exposure is likely limited to OPNsense deployments before 25.7.4 where non-fully-trusted accounts have Interfaces: PPPs: Edit permission. Systems without delegated PPP editing are less exposed, but still should update because privileged console users can be targeted.
Exploitation context
The provided sources do not show KEV listing or active exploitation. Exploitation requires authenticated access with at least Interfaces: PPPs: Edit permission and user interaction when another user visits the affected assignment page.
Researcher notes
Evidence supports stored XSS, not unauthenticated compromise. The public bundle names the vulnerable parameter and affected pages, but does not provide exploitation telemetry. Keep validation focused on version, permissions, and configuration review rather than offensive reproduction.
Mitigation direction
- Upgrade OPNsense to 25.7.4 or later.
- Review vendor release notes for the exact fixed release guidance.
- Limit Interfaces: PPPs: Edit permission to trusted administrators.
- Audit delegated administrator accounts and remove unnecessary PPP edit rights.
- Review PPP entries for unexpected or untrusted identifiers.
Validation and detection
- Inventory OPNsense systems and confirm their installed version.
- Flag any OPNsense instance older than 25.7.4.
- Review accounts or groups with Interfaces: PPPs: Edit permission.
- Check PPP configuration entries for unexpected HTML-like content.
- Confirm vendor release notes are reflected in change records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-34182 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
5.1MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://docs.opnsense.org/releases/CE_25.7.html#september-30-2025CVE reference, VulnCheck · vendor-advisory, patch
- https://www.vulncheck.com/advisories/decisio-opnsense-stored-xssCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.